CVE-2025-69195
Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
- Record
CVE-2025-69195- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2026-1777
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
- Record
EUVD-2026-1777- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q2gj-jpwc-8f46
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the...
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
- Record
GHSA-q2gj-jpwc-8f46- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
NVD
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
- Record
CVE-2025-69195- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
OSV
Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
- Record
CVE-2025-69195- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-69195
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
- Record
DEBIAN-CVE-2025-69195- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2025-69195
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
- Record
UBUNTU-CVE-2025-69195- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-73904 No score
CVE-2025-69195 affecting package wget for versions less than 2.1.0-7
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
- Record
AZL-73904- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:10015-1 No score
libwget4-2.2.1-1.1 on GA media
These are all security issues fixed in the libwget4-2.2.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10015-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20038-1 No score
Security update for wget2
This update for wget2 fixes the following issues:
Changes in wget2:
-
Update to release 2.2.1
- Fix file overwrite issue with metalink [CVE-2025-69194 bsc#1255728]
- Fix remote buffer overflow in get_local_filename_real() [CVE-2025-69195 bsc#1255729]
- Fix a redirect/mirror regression from 400713ca
- Use the local system timestamp when requested via --no-use-server-timestamps
- Prevent file truncation with --no-clobber
- Improve messages about why URLs are not being followed
- Fix metalink with -O/--output-document
- Fix sorting of metalink mirrors by priority
- Add --show-progress to improve backwards compatibility to wget
- Fix buffer overflow in wget_iri_clone() after wget_iri_set_scheme()
- Allow 'no_' prefix in config options
- Use libnghttp2 for HTTP/2 testing
- Set exit status to 8 on 403 response code
- Fix convert-links
- Fix --server-response for HTTP/1.1
-
Update to release 2.2.0
- Don't truncate file when -c and -O are combined
- Don't log URI userinfo to logs
- Fix downloading multiple files via HTTP/2
- Support connecting with HTTP/1.0 proxies
- Ignore 1xx HTTP responses for HTTP/1.1
- Disable TCP Fast Open by default
- Fix segfault when OCSP response is missing
- Add libproxy support
- Record
openSUSE-SU-2026:20038-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wgetAzure Linux:3 |
before 2.1.0-7 | 2.1.0-7 |
wget2Debian:13 |
before 2.2.0+ds-1+deb13u1, plus listed versions 2.2.0+ds-1 |
2.2.0+ds-1+deb13u1 |
wget2Debian:14 |
before 2.2.0+ds-3, plus listed versions 2.2.0+ds-12.2.0+ds-2 |
2.2.0+ds-3 |
wget2Ubuntu:18.04:LTS |
All versions, plus listed versions 0.0.20170806-1 |
None known |
wget2Ubuntu:20.04:LTS |
All versions, plus listed versions 1.99.1-21.99.1-2.1 |
None known |
wget2Ubuntu:22.04:LTS |
All versions, plus listed versions 1.99.1-2.2 |
None known |
wget2Ubuntu:24.04:LTS |
All versions, plus listed versions 1.99.1-2.22.1.0-22.1.0-2.1build12.1.0-2.1build2 |
None known |
wget2Ubuntu:25.10 |
All versions, plus listed versions 2.2.0+ds-1 |
None known |
wget2Ubuntu:26.10 |
All versions, plus listed versions 2.2.0+ds-3build1 |
None known |
wget2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.2.0+ds-12.2.0+ds-22.2.0+ds-32.2.0+ds-3build1 |
None known |
wget2openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.2.1-1.1 | 2.2.1-1.1 |
wget2openSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 2.2.1-bp160.1.1 | 2.2.1-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-69195 is a high vulnerability (CVSS 7.6) in Gnu Wget2, published January 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in wget 2.1.0-7.